Connect what you have. Replace nothing.
Weft connects to the platforms your team already knows. Each one you add gives the correlation engine another independent witness, which makes a crowded stack an advantage instead of a problem.
Deep correlation connectors.
The platforms Weft queries in place and writes native detections into. These carry the heaviest correlation and triangulation work.
Splunk
Reads from your existing indexes. Weft detections deploy as native correlation searches your team can open, test and tune.
Microsoft Sentinel
Works against your Log Analytics workspaces. Detections deploy as Sentinel analytics rules, and Weft cases link back to Sentinel incidents.
CrowdStrike
Endpoint telemetry and response actions, governed by your autonomy dial.
Google SecOps
UDM search and detections, with Weft adding cross-platform corroboration.
Databricks
Hunt across security data already in your lakehouse with Unity Catalog governance intact.
Already capable with the technologies you use every day.
Weft runs on Torq HyperSOC, so it ships with more than 400 prebuilt integrations across security, identity, cloud and IT. Weft uses them for enrichment, context and response, alongside the deep connectors above. Here’s a sample of what works out of the box.
SIEM and data platforms
- Splunk
- Microsoft Sentinel
- Google SecOps
- Elastic Security
- IBM QRadar
- Exabeam
- Sumo Logic
- Rapid7 InsightIDR
- Securonix
- Fortinet FortiSIEM
- Devo
- Snowflake
- Databricks
- Cribl
Endpoint and XDR
- CrowdStrike Falcon
- Microsoft Defender for Endpoint
- SentinelOne
- Palo Alto Cortex XDR
- Carbon Black
- Sophos
- Trellix
- Tanium
- Cybereason
- Huntress
Identity and access
- Okta
- Microsoft Entra ID
- Active Directory
- Duo
- PingOne
- CyberArk
- SailPoint
- JumpCloud
- OneLogin
- 1Password
Cloud and network
- AWS GuardDuty
- AWS Security Lake
- Google Cloud
- Wiz
- Prisma Cloud
- Zscaler
- Palo Alto PAN-OS
- Fortinet
- Check Point
- Cisco Umbrella
- Cloudflare
- Netskope
Email and collaboration security
- Microsoft 365
- Microsoft 365 Defender
- Proofpoint
- Mimecast
- Abnormal Security
- Gmail
Threat intelligence
- Google Threat Intelligence
- VirusTotal
- Anomali ThreatStream
- MISP
- GreyNoise
- Shodan
- DomainTools
- Flashpoint
- ThreatConnect
- urlscan
Vulnerability and exposure
- Tenable
- Qualys
- Rapid7 InsightVM
- Axonius
- Armis
- runZero
ITSM, paging and chat
- Jira Service Management
- Zendesk
- Freshservice
- PagerDuty
- Opsgenie
- Slack
- Microsoft Teams
- Zoom
How a connector behaves.
Connectors are the only part of Weft that touches your environment, so they’re built to be boring, narrow and easy to audit.
Outbound only
Connectors initiate every connection. Nothing in your environment opens an inbound port for Weft.
Read-only by default
Response permissions are granted per action type and only take effect at the autonomy level you choose.
Brokered credentials
Platform credentials live in a broker, never in the portal, the mobile app or a browser session.
Native detections
Detections ship in each platform’s own format, so your engineers can read, test and version them like their own.
Custom connectors on request.
Don’t see your tool? Anything with an API or a webhook can be connected, including older systems without modern APIs. Our team builds custom connectors with you, and they get the same monitoring and versioning as the prebuilt ones.
See Weft run against your own stack.
Bring the tools you already own. We’ll show you what they can see together.